after MS updates today system kaplunk

WinXP pro Media SP 3
Loaded the KB files and MS asked to reboot.
what the computer got was a logon.exe error pop up, clicked on cancel to debug, and got the blue screen with error logon message.
just cannot get past that logon pop up.

Tried system restore, accepted and did a restore to 2 days ago, but with the blue screen results.
tried other day last week, with the same results.


Got into safe mode.
cannot do sfc /scannow as it says RPC in not available
went iin to controlPanel/admintools/server and RPC is started and active?

what can I do in safe mode to correct?
Have run regcure.exe, retried booting did not help.

help would be most appreciated.
posting from girl friends computer

You can try a repair install.
http://www.michaelstevenstech.com/XPrepairinstall.htm

Are you sure the name is logon.exe?
Logon.exe is not a Windows file but a nasty.

to my joy, this AM.- I was able to load OS and able to go to command prompt and do sfc /scannow.
here I hit a snag, sort of.
asked for
insert tour windows XP pofessional service pack 3 CD now
which i have and did. Only to get a pop up stating "The CD provided is the wrong cd. Please insert the windows XP professional Service Pack 3 CD into your CD-Rom drive"

of course I can see the pop up in background stating "Microsoft Windows XP Service Pack 3 with advanced security Technologies"
clicked on cancel and continued.
asked for XP Pro disk which I inserted (which by the way has SP pack 2 included.
which it did ask for and the same results as sp3.
But it did go through after I hit the cancel it continues all the way.

question=
do I reload sp3, only
or do I reload SP2 and Than 3
or just do nothing?

I am running sfc a second time to be sure. will do a restore point.

ran Super Antiispyware but clean results.
will also try housecall trend micro after the sfc has finished.

You still didn't answer my question, is the error related to logon.exe?

If it is, open regedit (start > Run > type in regedit)
and scroll to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
On the right pane there will be a value Shell, it should be Explorer.exe.
If anything else, change it to Explorer.exe.

logon.exe is a virus. SuperantiSpyware doesn't mind if you have a different shell. It's not spyware.
Housecall should find it.

sorry DEP.-
no it is winlogon.exe.

frankb--Can you run System Restore from Safe Mode with internet connection, AV program and Firewall turned off?
The CD you are using for sfc /scannow is an SP3 CD and SP3 is what is installed on the PC, correct?

Welshjim.-
here is what I have on my system .-

Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Its up and running. I did trendmicro,superantispyware,spybot and now running defender. So far no virus, Trojan, spyware.

I placed SP2 disk that was supplied me by microsoft when asked. not recognised
I placed original WIN XP Pro with SP2 on the CD when asked. recognised and used
I placed SP3 which I had downloaded as a msi and did a CD-rom when asked. not recognised

In safe mode with internet connection its as slow as molasses.
No Zonealarm and or AVG loaded. so l eerie on being on line.

The only thing that puzzle me now is that I had some lines in Hijackthis that I don't see in the log.
referencing something like elsa winlogon from germany. bu I would guess that regcure took that out.
I can only surmise that this may have been the culprit!

Thank you all for the assistance. Guided me in the right direction to resolve.

I'll do two things only, and if doesn't work, reinstall windows...it'll be less time wasted.
a) uninstall the Updates, from control panel/programs install/uninstall
b) or uninstall the updates, from safe mode,,,
and please...Don't run more than one anti-virus and one anti-spyware program on your system, they fight between them to protect your computer that, they see each other as a threat...

Mad Max
only run one firewall ZoneAlarm.- free version
only run one Anti-virus AVG 8.x free version

Virus/trojan programs are on the system, but NOT running.
I run them only if I see a requirement to verify.

As to uninstalling and re-installing.
If it aint broke don't touch, still works for me.

no answer to the following

"question=
do I reload sp3, only
or do I reload SP2 and Than 3
or just do nothing?"

As, if I do or when I do "sfc /scannow" the same question will arise.

thank you for input.

If XP SP1 is installed then SP3 only is needed.

If it is just XP then SP! or SP2 then SP3 needs to be installed.

Now if you slip stream XP , then you do not run into problems with sfc /scannow.
Otherwise you need to uninstall the SP's so the OS then matches the cd.

Train

here is what I have on my system .-

Platform: Windows XP SP3 (WinNT 5.01.2600)

I would guess that the best route here would be to make a slipstream CD.
Like a project ToDo in the very near time frame.

Would sfc /scannow recognize the Slipstream Disk???

At this stage I will search out the control Panel add/remove and find the SP3 install.
Uninstall, and re-install. and than try sfc /scannow again to see results.

Quote:

---

Originally Posted by Train

If it is just XP then SP! or SP2 then SP3 needs to be installed.

---

Windows XP Service Pack 3 Overview
http://www.microsoft.com/downloads/d...displaylang=en

Quote:

---

Windows® XP Service Pack 3 (SP3) includes all previously released updates for the operating system.

---

(The "all previously released updates" would include both SP1 and SP2).

I missed that statement. Thanks!

No problem. :)

SpywareDR
That's what I figured also.
Seeing as SP3 is loaded. why is sfc /scannow asking for SP2 disk?

Belarc shows SP3 as loaded. All KB's from Microsoft are up to date.
The only one not loaded is KB953297 which is asking to act as a server.
My system is mine, not to be shared by Microsoft. denied. won't load.
so much for Net.Framework.

Quote:

---

Originally Posted by frankb

Seeing as SP3 is loaded. why is sfc /scannow asking for SP2 disk?

---

It must be having trouble trying to locate the file it thinks it needs?

Quote:

---

Originally Posted by frankb

The only one not loaded is KB953297 which is asking to act as a server.
My system is mine, not to be shared by Microsoft. denied. won't load.

---

http://discussions.virtualdr.com/sho...d.php?t=241626?

frankb--

Quote:

---

Guided me in the right direction to resolve.

---

So things are resolved?
Here is a reference that may help with using SFC in the future. You should not need the XP SP3 disk for the version of XP you now run. But it may help in the future to transfer all the I386 files from the disk over to your HardDrive before running SFC.
http://www.updatexp.com/scannow-sfc.html

to fast on resolve.
booting up this morning and pop up winlogon came back.
clicked on the X in top right hand corner and crossed hairs on head and waited.
Computer booted up and I am on in normal mode.

So much said.

I have gone in to hijack this and made a log.
I have gone into C;\I386 and the file is there but HP has it as a hidden File.
Even though in the Eplorer/tools/options/view I have the Check mark as show all hidden files.

I deleted the file folder in full.
replaced with I386 from OEM CD-rom with date 04/08/2004.
which list all files (Not Hidden)
I do have a recovery drive (E:) that HP controls so the speak.
Hidden, do not change (How can I)
IF I directed the Source Path as E:\ which has recovery files, including I386, would sfc/scannow recognize.

Question==
This CD also has folder
win51....1KB... File,
win511P...1KB... File,
win511P.SP2 1KB... SP2 File,

How can I enter/Load the SP2 to be recognised?
Same for the SP3 Disk I have?

Went into registry and noted that sourcePath was C:\windows\system32...Changed to C:\
Actually I had the CD-rom in the CD drive (F:\) and sfc /scannow fount it, and used it.


Guess Not resolved.
Will post to Hijack site my file.

when I did sfc /scannow i inserted the 1386 file only on cd and sfc recognised and used the CD.

The big question here is.=
If SP3 contains SP1,and SP2,
Why is SFC asking for SP2 at the end of the scannow three (3) times, before finishing.
I also made a CD with SP2 i386 file only from Microsoft which sfc did NOT
recognize.